VeilShell

Victims are likely the subject of phishing emails where the initial payload would be a zip file attached to the email.

Some features include data exfiltration, registry, and scheduled task creation or manipulation.

PowerShell was the primary code base used by the threat actors contained within the shortcut file.

Evaluate the decrypted string as JavaScript using Eval.JScriptEvaluate. JavaScript code is then executed.

Code execution was achieved through the usage of .lnk or shortcut files contained inside a zip archive. The shortcut files would leverage double extension techniques either ending in .pdf.lnk, or .xlsx.lnk.

MITRE ATT&CK Matrix ... Execution T1204.002: User Execution: Malicious File

Some features include data exfiltration, registry, and scheduled task creation or manipulation.

The attacker is able to send the following commands remotely to the infected computer... regedit Create or modify a registry key and value based on parameters sent by the attacker.

The command uses path traversal to first move backward... It defines a variable to the user’s Startup directory... The script then writes two files (d.exe.config and DomainManager.dll) into the Windows startup directory.

Some features include data exfiltration, registry, and scheduled task creation or manipulation.

The command uses path traversal to first move backward... It defines a variable to the user’s Startup directory... The script then writes two files (d.exe.config and DomainManager.dll) into the Windows startup directory.

The use of Base64 encoding and Caesar ciphers added to the overall stealthiness of the backdoor.

MITRE ATT&CK Matrix ... Defense Evasion T1070.004: Indicator Removal: File Deletion

The attacker is able to send the following commands remotely to the infected computer... regedit Create or modify a registry key and value based on parameters sent by the attacker.

MITRE ATT&CK Matrix ... Credential Access T1003: OS Credential Dumping

MITRE ATT&CK Matrix ... Credential Access T1555: Credentials from Password Stores

System details are then retrieved and stored into the $EVP variable. Details containing the computer name and username are then parsed and then concatenated to uniquely identify the victim machine.

MITRE ATT&CK Matrix ... Discovery T1057: Process Discovery

MITRE ATT&CK Matrix ... Discovery T1069: Permission Groups Discovery: Domain Groups

MITRE ATT&CK Matrix ... Discovery T1082: System Information Discovery

dir Compresses the specified directory into a .zip archive and upload it to the attacker’s server.

The use of Base64 encoding and Caesar ciphers added to the overall stealthiness of the backdoor, making it difficult for traditional security tools to analyze or detect the underlying malicious behavior.

This makes it a fully functional RAT capable of exfiltrating files, modifying the registry, creating scheduled tasks, and more.